Field of the Invention
The invention relates to a method of operating a boiling-water reactor which is an unstable state as a result of local oscillation of a physical variable (in particular of the power or of the neutron flux associated therewith). In addition, the invention relates to a device for carrying out this method and to a method and a device for monitoring the unstable reactor state.
The nuclear fission determining the power of a nuclear reactor is controlled by moving absorber elements into the reactor core in order to attenuate the neutron flux. In this arrangement, measuring lances having sensors for the flux of thermal neutrons are distributed over the reactor core, in order to register the current state. In order to adjust a desired operating state, it is also necessary for the throughput of coolant (cooling water), which serves at the same time as a moderator, to be adapted to the respective state.
The coolant enters in liquid phase into the reactor core from below, flows through the fuel elements, in which it partially evaporates, and emerges from the core as a vapor phase/liquid phase mixture, as a result of which the fuel/moderator ratio in the various parts of the fuel elements is changed. At the same time, however, the flow conditions are changed, in particular the location at which the single-phase flow, with which the liquid coolant enters the fuel elements, changes into the two-phase flow of the liquid/vapor mixture. In this case, at high power and low coolant throughput, unstable conditions have been observed in which this phase boundary goes into an oscillating motion, which results in a pulsation of the moderator density and the power, which has a bearing on the cooling capacity and the movement of the phase boundary. In this case, periodic temperature fluctuations with considerable peak values may occur in the fuel elements.
The permissible power maximum of the fuel elements is mainly limited by the temperature resistance of the materials used in the fuel elements. If an upper temperature limit is exceeded, the materials loose their mechanical, chemical and physical properties and can undergo irreversible changes, which can force an exchange of the fuel elements. Therefore, care must be taken that this thermal-hydraulic upper power threshold (and hence a thermal-hydraulic threshold value A.sub.th, of the neutron flux) in the reactor is not exceeded. Safety provisions in the reactor operation therefore call for a rapid shutdown of the reactor (so-called "SCRAM"), in the event the threshold value is exceeded. In such an emergency program, all the control rods are rapidly moved in and the corresponding cooling capacity is set.
Following such a SCRAM, the reactor is restarted according to a predetermined startup program, so that there is a considerable disturbance to the reactor operation. In addition, the fuel elements have to be changed for safety reasons, if the thermal-hydraulic threshold value has been reached many times or over a relatively long period of time.
The art is therefore concerned with detecting and damping an unstable state of this type as early as possible, before the power pulsations reach the vicinity of the thermal-hydraulic threshold value.
It has been shown that these pulsations always occur in a frequency range between about 0.3 and 0.7 Hz and have a very constant frequency. The method described in U.S. Pat. No. 5,174,946 to Watford et al. (=EP 0 496 551) for monitoring the power fluctuation band for nuclear reactors is based on that fact.
That process utilizes the flux as a measured variable for the unstable state caused by the local oscillation of a physical variable, the measuring lances mentioned ("local power range monitor-strings", LPRM strings) being used for this flux measurement. Each such lance normally contains four sensors, whose signals are observed anyway for power control purposes, then further processed and documented.
Each of these four sensors in each measuring lance is used, two sensors being assigned to a first monitoring system, the two remaining sensors being assigned to a redundant second monitoring system. Each monitoring system thereby contains two monitoring channels, each sensor signal of a measuring lance being assigned to a different monitoring channel. Different subdivisions of the reactor into individual regions ("monitoring cells") are in this case based on the two monitoring channels of a system, each cell being bounded by four measuring lances in order to form a corresponding region signal. Depending on the location of the measuring lance in the core (in the interior of the core or at the edge of the core), a sensor signal in each monitoring channel belongs to two, three or four cells. As a result of this multiple use of the sensor signals, it is intended to achieve the situation where virtually the state of each individual fuel element can be monitored and identified by means of the influence which it has on the sensor signals of the individual cells. To this end, provision is made that an alarm is set in a system only when both monitoring channels respond. Although it is sufficient for the alarm to be given by one of the two systems, only simple redundancy is provided thereby.
A further disadvantage is that virtually all the monitoring channels are affected by an erroneous measurement or a complete failure of a measuring lance, it being possible in the case of an edge position of the measuring lance, for example, that simultaneously a plurality of cells are no longer being monitored properly.
The state of the individual cells (regions) is monitored by initially monitoring in a plausibility control whether the individual sensor signal exceeds a specific lower threshold value and is operating properly. In the case of a sensor defect, the signals belonging to this cell are not evaluated further. By means of summing all the sensor signals of a region, a current region signal is formed which is suppressed, however, if (for example as a result of an erroneous measurement) a plausibility monitoring yields the fact that the region signal does not achieve a predefined minimum value. The region signal is then filtered and related to an average over time, the time constant of which is greater than a period of the oscillation, so that a relative current region signal is produced which indicates by how many percent the current power of the region lies above or below the average.
If this current value exceeds a power limit (for example 120%), a check is then made as to whether this is a once-off transition state (so-called "transient") which for example constitutes only an aperiodic transition to a new operating state predefined by the control, without exciting an oscillation. In this case, this is not therefore a critical oscillation in the frequency band from 0.3 to 0.7 Hz, so that no intervention is carried out as long as a threshold value A.sub.max, lying in the vicinity of the thermal-hydraulic threshold value A.sub.th, is not reached.
In order to detect the critical oscillation, instead an examination is made to see whether, in a time interval corresponding to this critical frequency band, the value does not also fall below a corresponding threshold value (e.g. 80%) following the exceeding of a limiting value A.sub.o as is necessary for an oscillation. If it is determined in this way that--corresponding to an oscillation--a lower extreme value follows an upper extreme value of the flux, a check is further made as to whether another upper extreme value follows this lower extreme value, and whether this following upper extreme value exceeds an alarm value which lies above the extreme value detected first by a predefined factor (e.g. 1.3). If this is so, then after this one oscillation period it is already concluded that there is a growing, i.e., increasing oscillation, in which the exceeding of A.sub.th is threatened, and the SCRAM is initiated even before the value A.sub.max is reached.
With an eye to the present invention, reference is made at this point that, although the above-described prior art monitors whether the oscillation is growing at a rate lying above the predefined factor (here 1.3), the growth (rate of increase) of the extreme values is not itself measured. This factor (1.3) is also relative in as much as it is related to the extreme value detected first, but it independent of the rate of increase.
In addition, reference is made to the fact that although it is checked whether the time interval between the detected extreme values corresponds to the critical frequency band of 0.3 and 0.7 Hz, no check is made as to whether the next extreme value A.sub.n+1, follows in practice at the same interval DT.sub.n, which is given by the previously detected upper extreme value (denoted A.sub.n-1, point in time T.sub.n-1) and the presently detected lower extreme value (A.sub.n, point in time T.sub.n), after this point in time T.sub.n. Those skilled in the art of reactor control and monitoring will appreciate that the usual techniques for the monitoring and documentation of the sensor signals apply and they will therefore readily be able not only to register the extreme values A.sub.n-1, A.sub.n, A.sub.n+1 . . . but also the points in time T.sub.n-1, T.sub.n, T.sub.n+1 . . . at which these extreme values occur. The person in charge of monitoring could therefore readily suppress the corresponding region signal if the time interval DT.sub.n =T.sub.n -T.sub.n-1 deviates significantly (for example 0.1 seconds) from the time interval DT.sub.n+1 =T.sub.n+1 -T.sub.n. However, U.S. Pat. No. 5,174,946 contains no advice on this point.
In the state of that prior art, therefore, no attention is initially paid to an oscillation whose (unmeasured) rate of increase lies below the set factor (1.3); rather, intervention is considered in the reactor operation only when its extreme values exceed the threshold value A.sub.max. Only rapidly increasing oscillations cause this extremely critical state to be recognized in good time and to the initiation of suitable countermeasures. Apparently, it is assumed that slowly increasing oscillations inherently decay by themselves and normally do not require a SCRAM.
To be specific, that prior art provides as counter-measure only to damp the oscillation by means of rapidly moving in virtually all the control rods (total SCRAM). That is to say, apart from the SCRAM, this strategy provides no further measure for damping the oscillation and does not reduce the probability of the SCRAM either, which constitutes a considerable intervention in the reactor operation. Instead, in the event that there is a rapidly increasing oscillation, damping only takes place earlier (i.e., below A.sub.max). As a result, only the thermal loading of the fuel elements is reduced.